topic Re: Using lookup tables and searching it twice in Splunk Search

Using lookup tables and searching it twice

rmorlen — Thu, 26 Dec 2013 14:52:10 GMT

We have a user lookup table that contains information such as username, email, and managername. I can do a lookup to find a user's managername.

| inputlookup userlookup | search username="bob" | fields username, email, manager

From that I would like to get the email address for the manager. Something like:

| inputlookup userlookup | search username="bob"| fields manager | rename manager AS empManager | search [| inputlookup userlookup username=empManager]

Which doesn't work because the syntax is all screwed up (and I'm not good with lookup tables).

Re: Using lookup tables and searching it twice

sc0tt — Thu, 26 Dec 2013 15:14:18 GMT

I think something like this should work:

..search | fields username
| lookup userlookup username OUTPUT manager
| lookup userlookup username as manager OUTPUT emailaddress

Since you have the manager name in the lookup table, it may be a good idea to just include an additional field with the manager's email.

Re: Using lookup tables and searching it twice

rmorlen — Thu, 26 Dec 2013 15:40:21 GMT

Thank you. That worked.